{
  "history": [
    {
      "added": 0,
      "commit": "668f5df05042088125d83d197252b5a8e78422df",
      "date": "2026-11-01",
      "dependencies": 146,
      "errors": [],
      "fixable": 3,
      "go_version": "go1.26.9",
      "in_binary": {
        "dependencies": 1,
        "stdlib": 1,
        "total": 2
      },
      "new_vulnerabilities": 0,
      "osv_confirmed": 4,
      "osv_only": 1,
      "ref": "v2.1.3",
      "release_changed": false,
      "release_integrity": "checksums-only",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 6.3,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 1,
        "Negligible": 0,
        "Unknown": 3
      },
      "workflow": {
        "High": 6,
        "Low": 2,
        "Medium": 4,
        "files": 10
      }
    },
    {
      "added": 0,
      "commit": "668f5df05042088125d83d197252b5a8e78422df",
      "date": "2026-11-02",
      "dependencies": 146,
      "errors": [],
      "fixable": 3,
      "go_version": "go1.26.9",
      "in_binary": {
        "dependencies": 1,
        "stdlib": 1,
        "total": 2
      },
      "kev": 0,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 4,
      "osv_only": 1,
      "ref": "v2.1.3",
      "release_changed": false,
      "release_integrity": "checksums-only",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 6.3,
      "scorecard_date": "2026-10-19",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 1,
        "Negligible": 0,
        "Unknown": 3
      },
      "vulnerable_packages": 3,
      "workflow": {
        "High": 6,
        "Low": 2,
        "Medium": 4,
        "files": 10
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Static Application Security Testing (SAST) \u203a Multi-language",
    "changes": {
      "added": [],
      "any": false,
      "baseline": false,
      "in_binary_new": [],
      "in_binary_resolved": [],
      "integrity_drift": 0,
      "license_changes": [],
      "new_vulnerabilities": [],
      "previous_ref": "v2.1.3",
      "release_changed": false,
      "removed": [],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "668f5df05042088125d83d197252b5a8e78422df",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "actions/cache",
        "purl": "pkg:github/actions/cache@v6.1.0",
        "version": "v6.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/version_comparison.yml",
        "name": "actions/cache/restore",
        "purl": "pkg:github/actions/cache@v6.1.0#restore",
        "version": "v6.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/version_comparison.yml",
        "name": "actions/cache/save",
        "purl": "pkg:github/actions/cache@v6.1.0#save",
        "version": "v6.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v7.0.1",
        "version": "v7.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/docs.yml",
        "name": "actions/deploy-pages",
        "purl": "pkg:github/actions/deploy-pages@v5.0.1",
        "version": "v5.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "actions/setup-go",
        "purl": "pkg:github/actions/setup-go@v7.0.0",
        "version": "v7.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/command_doc_check.yml",
        "name": "actions/setup-node",
        "purl": "pkg:github/actions/setup-node@v7.1.0",
        "version": "v7.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/docs.yml",
        "name": "actions/upload-pages-artifact",
        "purl": "pkg:github/actions/upload-pages-artifact@v5.0.0",
        "version": "v5.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/lint_pr.yml",
        "name": "amannn/action-semantic-pull-request",
        "purl": "pkg:github/amannn/action-semantic-pull-request@v6",
        "version": "v6"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "Apple-Actions/import-codesign-certs",
        "purl": "pkg:github/Apple-Actions/import-codesign-certs@v7.1.0",
        "version": "v7.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/release.yml",
        "name": "cycodelabs/cimon-action",
        "purl": "pkg:github/cycodelabs/cimon-action@v0",
        "version": "v0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/lint.yml",
        "name": "golangci/golangci-lint-action",
        "purl": "pkg:github/golangci/golangci-lint-action@v9",
        "version": "v9"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "goreleaser/goreleaser-action",
        "purl": "pkg:github/goreleaser/goreleaser-action@v5",
        "version": "v5"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "mathieudutour/github-tag-action",
        "purl": "pkg:github/mathieudutour/github-tag-action@v6.2",
        "version": "v6.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "dario.cat/mergo",
        "purl": "pkg:golang/dario.cat/mergo@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/agnivade/levenshtein",
        "purl": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/andybalholm/brotli",
        "purl": "pkg:golang/github.com/andybalholm/brotli@v1.1.2-0.20250424173009-453214e765f3",
        "version": "v1.1.2-0.20250424173009-453214e765f3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/aymanbagabas/go-osc52/v2",
        "purl": "pkg:golang/github.com/aymanbagabas/go-osc52/v2@v2.0.1",
        "version": "v2.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bearer/go-vcsurl",
        "purl": "pkg:golang/github.com/bearer/go-vcsurl@v0.0.0-20240112143255-3be11ce9a61e",
        "version": "v0.0.0-20240112143255-3be11ce9a61e"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bits-and-blooms/bitset",
        "purl": "pkg:golang/github.com/bits-and-blooms/bitset@v1.26.0",
        "version": "v1.26.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/BobuSumisu/aho-corasick",
        "purl": "pkg:golang/github.com/BobuSumisu/aho-corasick@v1.0.3",
        "version": "v1.0.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bodgit/plumbing",
        "purl": "pkg:golang/github.com/bodgit/plumbing@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bodgit/sevenzip",
        "purl": "pkg:golang/github.com/bodgit/sevenzip@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bodgit/windows",
        "purl": "pkg:golang/github.com/bodgit/windows@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/bradleyjkemp/cupaloy",
        "purl": "pkg:golang/github.com/bradleyjkemp/cupaloy@v2.3.0%2Bincompatible",
        "version": "v2.3.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/buildkite/terminal",
        "purl": "pkg:golang/github.com/buildkite/terminal@v3.2.0%2Bincompatible",
        "version": "v3.2.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cespare/xxhash/v2",
        "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0",
        "version": "v2.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/cfabianski/viper",
        "purl": "pkg:golang/github.com/cfabianski/viper@v1.15.1-0.20231221085120-53a0f7864cd6",
        "version": "v1.15.1-0.20231221085120-53a0f7864cd6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/charmbracelet/lipgloss",
        "purl": "pkg:golang/github.com/charmbracelet/lipgloss@v0.6.0",
        "version": "v0.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/clipperhouse/uax29/v2",
        "purl": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.6.0",
        "version": "v2.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/davecgh/go-spew",
        "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc",
        "version": "v1.1.2-0.20180830191138-d8f796af33cc"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
        "purl": "pkg:golang/github.com/decred/dcrd/dcrec/secp256k1/v4@v4.4.1",
        "version": "v4.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dsnet/compress",
        "purl": "pkg:golang/github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707",
        "version": "v0.0.2-0.20230904184137-39efe44ab707"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/dustin/go-humanize",
        "purl": "pkg:golang/github.com/dustin/go-humanize@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fatih/color",
        "purl": "pkg:golang/github.com/fatih/color@v1.19.0",
        "version": "v1.19.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fatih/semgroup",
        "purl": "pkg:golang/github.com/fatih/semgroup@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/fsnotify/fsnotify",
        "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1",
        "version": "v1.10.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gertd/go-pluralize",
        "purl": "pkg:golang/github.com/gertd/go-pluralize@v0.2.1",
        "version": "v0.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gitleaks/go-gitdiff",
        "purl": "pkg:golang/github.com/gitleaks/go-gitdiff@v0.9.1",
        "version": "v0.9.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-enry/go-enry/v2",
        "purl": "pkg:golang/github.com/go-enry/go-enry/v2@v2.9.6",
        "version": "v2.9.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-enry/go-oniguruma",
        "purl": "pkg:golang/github.com/go-enry/go-oniguruma@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/go-ole/go-ole",
        "purl": "pkg:golang/github.com/go-ole/go-ole@v1.2.6",
        "version": "v1.2.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/gobwas/glob",
        "purl": "pkg:golang/github.com/gobwas/glob@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/goccy/go-json",
        "purl": "pkg:golang/github.com/goccy/go-json@v0.10.6",
        "version": "v0.10.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-github",
        "purl": "pkg:golang/github.com/google/go-github@v17.0.0%2Bincompatible",
        "version": "v17.0.0+incompatible"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/go-querystring",
        "purl": "pkg:golang/github.com/google/go-querystring@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/google/uuid",
        "purl": "pkg:golang/github.com/google/uuid@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/h2non/filetype",
        "purl": "pkg:golang/github.com/h2non/filetype@v1.1.3",
        "version": "v1.1.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/errwrap",
        "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-multierror",
        "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/go-version",
        "purl": "pkg:golang/github.com/hashicorp/go-version@v1.7.0",
        "version": "v1.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/golang-lru/v2",
        "purl": "pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7",
        "version": "v2.0.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hashicorp/hcl",
        "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/hhatto/gocloc",
        "purl": "pkg:golang/github.com/hhatto/gocloc@v0.7.0",
        "version": "v0.7.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/huandu/xstrings",
        "purl": "pkg:golang/github.com/huandu/xstrings@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/inconshreveable/mousetrap",
        "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0",
        "version": "v1.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/klauspost/compress",
        "purl": "pkg:golang/github.com/klauspost/compress@v1.20.0",
        "version": "v1.20.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/klauspost/pgzip",
        "purl": "pkg:golang/github.com/klauspost/pgzip@v1.2.6",
        "version": "v1.2.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/blackmagic",
        "purl": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4",
        "version": "v1.0.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/dsig",
        "purl": "pkg:golang/github.com/lestrrat-go/dsig@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/dsig-secp256k1",
        "purl": "pkg:golang/github.com/lestrrat-go/dsig-secp256k1@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/httpcc",
        "purl": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/httprc/v3",
        "purl": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.6",
        "version": "v3.0.6"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/jwx/v3",
        "purl": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.3.0",
        "version": "v3.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lestrrat-go/option/v2",
        "purl": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0",
        "version": "v2.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lucasb-eyer/go-colorful",
        "purl": "pkg:golang/github.com/lucasb-eyer/go-colorful@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/lufia/plan9stats",
        "purl": "pkg:golang/github.com/lufia/plan9stats@v0.0.0-20211012122336-39d0f177ccd0",
        "version": "v0.0.0-20211012122336-39d0f177ccd0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/magiconair/properties",
        "purl": "pkg:golang/github.com/magiconair/properties@v1.8.9",
        "version": "v1.8.9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/goutils",
        "purl": "pkg:golang/github.com/Masterminds/goutils@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/semver/v3",
        "purl": "pkg:golang/github.com/Masterminds/semver/v3@v3.3.0",
        "version": "v3.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/Masterminds/sprig/v3",
        "purl": "pkg:golang/github.com/Masterminds/sprig/v3@v3.3.0",
        "version": "v3.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-colorable",
        "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.14",
        "version": "v0.1.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-isatty",
        "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.22",
        "version": "v0.0.22"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mattn/go-runewidth",
        "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.31",
        "version": "v0.0.31"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mholt/archives",
        "purl": "pkg:golang/github.com/mholt/archives@v0.1.2",
        "version": "v0.1.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/minio/minlz",
        "purl": "pkg:golang/github.com/minio/minlz@v1.0.0",
        "version": "v1.0.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/colorstring",
        "purl": "pkg:golang/github.com/mitchellh/colorstring@v0.0.0-20190213212951-d06e56a500db",
        "version": "v0.0.0-20190213212951-d06e56a500db"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/copystructure",
        "purl": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/mapstructure",
        "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0",
        "version": "v1.5.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/mitchellh/reflectwalk",
        "purl": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2",
        "version": "v1.0.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/reflow",
        "purl": "pkg:golang/github.com/muesli/reflow@v0.3.0",
        "version": "v0.3.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/muesli/termenv",
        "purl": "pkg:golang/github.com/muesli/termenv@v0.15.1",
        "version": "v0.15.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/nwaples/rardecode/v2",
        "purl": "pkg:golang/github.com/nwaples/rardecode/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/open-policy-agent/opa",
        "purl": "pkg:golang/github.com/open-policy-agent/opa@v1.21.3",
        "version": "v1.21.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pelletier/go-toml/v2",
        "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.4.3",
        "version": "v2.4.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pierrec/lz4/v4",
        "purl": "pkg:golang/github.com/pierrec/lz4/v4@v4.1.21",
        "version": "v4.1.21"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/pmezard/go-difflib",
        "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2",
        "version": "v1.0.1-0.20181226105442-5d4384ee4fb2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/power-devops/perfstat",
        "purl": "pkg:golang/github.com/power-devops/perfstat@v0.0.0-20210106213030-5aafc221ea8c",
        "version": "v0.0.0-20210106213030-5aafc221ea8c"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rcrowley/go-metrics",
        "purl": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9",
        "version": "v0.0.0-20250401214520-65e299d6c5c9"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rivo/uniseg",
        "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7",
        "version": "v0.4.7"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rodaine/table",
        "purl": "pkg:golang/github.com/rodaine/table@v1.4.1",
        "version": "v1.4.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/rs/zerolog",
        "purl": "pkg:golang/github.com/rs/zerolog@v1.35.1",
        "version": "v1.35.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/russross/blackfriday/v2",
        "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0",
        "version": "v2.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sabhiram/go-gitignore",
        "purl": "pkg:golang/github.com/sabhiram/go-gitignore@v0.0.0-20210923224102-525f6e181f06",
        "version": "v0.0.0-20210923224102-525f6e181f06"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sagikazarmark/locafero",
        "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0",
        "version": "v0.11.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sagikazarmark/slog-shim",
        "purl": "pkg:golang/github.com/sagikazarmark/slog-shim@v0.1.0",
        "version": "v0.1.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/schollz/progressbar/v3",
        "purl": "pkg:golang/github.com/schollz/progressbar/v3@v3.19.1",
        "version": "v3.19.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/segmentio/asm",
        "purl": "pkg:golang/github.com/segmentio/asm@v1.2.1",
        "version": "v1.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/shirou/gopsutil/v3",
        "purl": "pkg:golang/github.com/shirou/gopsutil/v3@v3.24.5",
        "version": "v3.24.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/shoenig/go-m1cpu",
        "purl": "pkg:golang/github.com/shoenig/go-m1cpu@v0.2.1",
        "version": "v0.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/shopspring/decimal",
        "purl": "pkg:golang/github.com/shopspring/decimal@v1.4.0",
        "version": "v1.4.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sirupsen/logrus",
        "purl": "pkg:golang/github.com/sirupsen/logrus@v1.10.2",
        "version": "v1.10.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/smacker/go-tree-sitter",
        "purl": "pkg:golang/github.com/smacker/go-tree-sitter@v0.0.0-20240827094217-dd81d9e9be82",
        "version": "v0.0.0-20240827094217-dd81d9e9be82"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sorairolake/lzip-go",
        "purl": "pkg:golang/github.com/sorairolake/lzip-go@v0.3.5",
        "version": "v0.3.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/sourcegraph/conc",
        "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8",
        "version": "v0.3.1-0.20240121214520-5f936abd7ae8"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/afero",
        "purl": "pkg:golang/github.com/spf13/afero@v1.15.0",
        "version": "v1.15.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/cast",
        "purl": "pkg:golang/github.com/spf13/cast@v1.10.0",
        "version": "v1.10.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/cobra",
        "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2",
        "version": "v1.10.2"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/spf13/pflag",
        "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10",
        "version": "v1.0.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/STARRY-S/zip",
        "purl": "pkg:golang/github.com/STARRY-S/zip@v0.2.1",
        "version": "v0.2.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/stretchr/testify",
        "purl": "pkg:golang/github.com/stretchr/testify@v1.12.1",
        "version": "v1.12.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/subosito/gotenv",
        "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tchap/go-patricia/v2",
        "purl": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3",
        "version": "v2.3.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tetratelabs/wazero",
        "purl": "pkg:golang/github.com/tetratelabs/wazero@v1.12.0",
        "version": "v1.12.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/therootcompany/xz",
        "purl": "pkg:golang/github.com/therootcompany/xz@v1.0.1",
        "version": "v1.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tklauser/go-sysconf",
        "purl": "pkg:golang/github.com/tklauser/go-sysconf@v0.3.12",
        "version": "v0.3.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/tklauser/numcpus",
        "purl": "pkg:golang/github.com/tklauser/numcpus@v0.6.1",
        "version": "v0.6.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/ulikunitz/xz",
        "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.14",
        "version": "v0.5.14"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/valyala/fastjson",
        "purl": "pkg:golang/github.com/valyala/fastjson@v1.6.10",
        "version": "v1.6.10"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/vektah/gqlparser/v2",
        "purl": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.37",
        "version": "v2.5.37"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/wasilibs/go-re2",
        "purl": "pkg:golang/github.com/wasilibs/go-re2@v1.9.0",
        "version": "v1.9.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/wasilibs/wazero-helpers",
        "purl": "pkg:golang/github.com/wasilibs/wazero-helpers@v0.0.0-20240620070341-3dff1577cd52",
        "version": "v0.0.0-20240620070341-3dff1577cd52"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/weppos/publicsuffix-go",
        "purl": "pkg:golang/github.com/weppos/publicsuffix-go@v0.50.3",
        "version": "v0.50.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xeipuuv/gojsonpointer",
        "purl": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb",
        "version": "v0.0.0-20190905194746-02993c407bfb"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xeipuuv/gojsonreference",
        "purl": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415",
        "version": "v0.0.0-20180127040603-bd5ef7bd5415"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/xeipuuv/gojsonschema",
        "purl": "pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0",
        "version": "v1.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yashtewari/glob-intersection",
        "purl": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0",
        "version": "v0.2.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/yusufpapurcu/wmi",
        "purl": "pkg:golang/github.com/yusufpapurcu/wmi@v1.2.4",
        "version": "v1.2.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "github.com/zricethezav/gitleaks/v8",
        "purl": "pkg:golang/github.com/zricethezav/gitleaks/v8@v8.30.1",
        "version": "v8.30.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v2",
        "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4",
        "version": "v2.4.4"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go.yaml.in/yaml/v3",
        "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.5",
        "version": "v3.0.5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "go4.org",
        "purl": "pkg:golang/go4.org@v0.0.0-20230225012048-214862532bf5",
        "version": "v0.0.0-20230225012048-214862532bf5"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/crypto",
        "purl": "pkg:golang/golang.org/x/crypto@v0.58.0",
        "version": "v0.58.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/exp",
        "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20250218142911-aa4b98e5adaa",
        "version": "v0.0.0-20250218142911-aa4b98e5adaa"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/mod",
        "purl": "pkg:golang/golang.org/x/mod@v0.42.0",
        "version": "v0.42.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/net",
        "purl": "pkg:golang/golang.org/x/net@v0.61.0",
        "version": "v0.61.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/oauth2",
        "purl": "pkg:golang/golang.org/x/oauth2@v0.37.0",
        "version": "v0.37.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sync",
        "purl": "pkg:golang/golang.org/x/sync@v0.24.0",
        "version": "v0.24.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/sys",
        "purl": "pkg:golang/golang.org/x/sys@v0.49.0",
        "version": "v0.49.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/term",
        "purl": "pkg:golang/golang.org/x/term@v0.47.0",
        "version": "v0.47.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "golang.org/x/text",
        "purl": "pkg:golang/golang.org/x/text@v0.43.0",
        "version": "v0.43.0"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "google.golang.org/protobuf",
        "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12",
        "version": "v1.36.12"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/ini.v1",
        "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.3",
        "version": "v1.67.3"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "gopkg.in/yaml.v3",
        "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
        "version": "v3.0.1"
      },
      {
        "ecosystem": "golang",
        "licenses": [],
        "location": "go.mod",
        "name": "sigs.k8s.io/yaml",
        "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0",
        "version": "v1.6.0"
      },
      {
        "ecosystem": "unknown",
        "licenses": [],
        "location": ".github/workflows/canary.yml",
        "name": "./.github/actions/linux-build",
        "purl": "",
        "version": "UNKNOWN"
      }
    ],
    "description": "Trace sensitive data flows and detect security risks in code",
    "errors": [],
    "go_binary": {
      "asset": "bearer_2.1.3_linux_amd64.tar.gz",
      "binary": "bearer",
      "db": "https://vuln.go.dev",
      "db_last_modified": "2026-10-27T21:16:18Z",
      "findings": [
        {
          "aliases": [
            "CVE-2026-111943"
          ],
          "epss": {
            "cve": "CVE-2026-111943",
            "percentile": 0.33793,
            "score": 0.00396
          },
          "fixed_version": "v1.26.10",
          "id": "GO-2026-6809",
          "kev": null,
          "level": "symbol",
          "module": "stdlib",
          "summary": "Distrust compromised intermediate certificates in crypto/x509",
          "version": "v1.26.9"
        },
        {
          "aliases": [
            "CVE-2025-58058",
            "GHSA-jc7w-c686-c4v9"
          ],
          "epss": {
            "cve": "CVE-2025-58058",
            "percentile": 0.37578,
            "score": 0.00433
          },
          "fixed_version": "v0.5.15",
          "id": "GO-2025-3922",
          "kev": null,
          "level": "symbol",
          "module": "github.com/ulikunitz/xz",
          "summary": "Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz",
          "version": "v0.5.14"
        },
        {
          "aliases": [
            "CVE-2025-11579",
            "GHSA-rwvp-r38j-9rgg"
          ],
          "epss": {
            "cve": "CVE-2025-11579",
            "percentile": 0.31402,
            "score": 0.00374
          },
          "fixed_version": "v2.2.0",
          "id": "GO-2025-4020",
          "kev": null,
          "level": "package",
          "module": "github.com/nwaples/rardecode/v2",
          "summary": "DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode",
          "version": "v2.1.0"
        },
        {
          "aliases": [],
          "epss": null,
          "fixed_version": "",
          "id": "GO-2026-5932",
          "kev": null,
          "level": "module",
          "module": "golang.org/x/crypto",
          "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues",
          "version": "v0.58.0"
        },
        {
          "aliases": [
            "CVE-2026-78661"
          ],
          "epss": {
            "cve": "CVE-2026-78661",
            "percentile": 0.08063,
            "score": 0.00185
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6860",
          "kev": null,
          "level": "module",
          "module": "golang.org/x/net",
          "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net",
          "version": "v0.61.0"
        },
        {
          "aliases": [
            "CVE-2026-97045"
          ],
          "epss": {
            "cve": "CVE-2026-97045",
            "percentile": 0.10117,
            "score": 0.00202
          },
          "fixed_version": "v0.62.0",
          "id": "GO-2026-6866",
          "kev": null,
          "level": "module",
          "module": "golang.org/x/net",
          "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net",
          "version": "v0.61.0"
        }
      ],
      "go_version": "go1.26.9",
      "main_module": "github.com/bearer/bearer"
    },
    "id": "Bearer__bearer",
    "manifests": [
      ".github/workflows/canary.yml",
      ".github/workflows/command_doc_check.yml",
      ".github/workflows/docs.yml",
      ".github/workflows/e2e_test.yml",
      ".github/workflows/lint.yml",
      ".github/workflows/lint_docs.yml",
      ".github/workflows/lint_pr.yml",
      ".github/workflows/release.yml",
      ".github/workflows/test.yml",
      ".github/workflows/version_comparison.yml",
      "go.mod",
      "go.sum",
      "pkg/parser/sitter/config_variables/package.json"
    ],
    "name": "bearer",
    "osv": {
      "advisories": 5,
      "available": true,
      "confirmed": 4,
      "osv_only": [
        {
          "ecosystem": "Go",
          "ids": [
            "CVE-2025-58058",
            "GHSA-jc7w-c686-c4v9",
            "GO-2025-3922"
          ],
          "package": "github.com/ulikunitz/xz",
          "score": "5.3",
          "severity": "Medium",
          "version": "0.5.14"
        }
      ],
      "warning": null
    },
    "ref": "v2.1.3",
    "ref_kind": "release",
    "release_integrity": {
      "asset": "bearer_2.1.3_linux_amd64.tar.gz",
      "assets": 11,
      "build_provenance": null,
      "checksums_published": true,
      "digest_matches_github": true,
      "immutable_release": null,
      "methods": [],
      "provenance_published": false,
      "sbom_published": false,
      "signature": null,
      "signatures_published": false,
      "signer": null,
      "verdict": "checksums-only"
    },
    "released_at": "2026-10-28T14:31:00Z",
    "repository": "Bearer/bearer",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 0,
      "drift": {},
      "findings": [
        "0 version changes among 181 shared packages \u2014 no actual upgrades",
        "Core system packages stable: golang (131), github (37), file (11) unchanged"
      ],
      "removed": 0
    },
    "scanned_at": "2026-11-02T03:06:48+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "CII-Best-Practices",
          "reason": "no effort to earn an OpenSSF best practices badge detected",
          "score": 0
        },
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Signed-Releases",
          "reason": "Project has not signed or included provenance with any releases.",
          "score": 0
        },
        {
          "name": "Token-Permissions",
          "reason": "detected GitHub workflow tokens with excessive permissions",
          "score": 0
        },
        {
          "name": "Code-Review",
          "reason": "Found 2/5 approved changesets -- score normalized to 4",
          "score": 4
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 8",
          "score": 8
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 9
        },
        {
          "name": "SAST",
          "reason": "SAST tool is not run on all commits -- score normalized to 9",
          "score": 9
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow detected",
          "score": 10
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file detected",
          "score": 10
        },
        {
          "name": "Branch-Protection",
          "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
          "score": -1
        }
      ],
      "date": "2026-10-19",
      "score": 6.3,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [
      {
        "aliases": [
          "CVE-2025-11579"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2025-11579",
          "percentile": 0.31402,
          "score": 0.00374
        },
        "fix_state": "fixed",
        "fixed_in": [
          "2.2.0"
        ],
        "id": "GHSA-rwvp-r38j-9rgg",
        "in_binary": "package in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "github.com/nwaples/rardecode/v2",
        "severity": "Medium",
        "summary": "rardecode: DoS risk due to unrestricted RAR dictionary sizes",
        "url": "https://github.com/advisories/GHSA-rwvp-r38j-9rgg",
        "version": "v2.1.0"
      },
      {
        "aliases": [],
        "ecosystem": "golang",
        "epss": null,
        "fix_state": "unknown",
        "fixed_in": [],
        "id": "GO-2026-5932",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/crypto",
        "severity": "Unknown",
        "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f",
        "url": "https://go.dev/issue/44226",
        "version": "v0.58.0"
      },
      {
        "aliases": [
          "CVE-2026-78661"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-78661",
          "percentile": 0.08063,
          "score": 0.00185
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6860",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") cau",
        "url": "https://go.dev/cl/849365",
        "version": "v0.61.0"
      },
      {
        "aliases": [
          "CVE-2026-97045"
        ],
        "ecosystem": "golang",
        "epss": {
          "cve": "CVE-2026-97045",
          "percentile": 0.10117,
          "score": 0.00202
        },
        "fix_state": "fixed",
        "fixed_in": [
          "0.62.0"
        ],
        "id": "GO-2026-6866",
        "in_binary": "module in binary",
        "kev": null,
        "location": "go.mod",
        "osv_confirmed": true,
        "package": "golang.org/x/net",
        "severity": "Unknown",
        "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> f",
        "url": "https://go.dev/cl/855121",
        "version": "v0.61.0"
      }
    ],
    "workflow_audit": {
      "files": 10,
      "findings": [
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/canary.yml",
          "line": 6,
          "note": "contents: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/docs.yml",
          "line": 10,
          "note": "pages: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/docs.yml",
          "line": 11,
          "note": "id-token: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "use of fundamentally insecure workflow trigger",
          "file": ".github/workflows/lint_pr.yml",
          "line": 3,
          "note": "this workflow",
          "rule": "dangerous-triggers",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#dangerous-triggers"
        },
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/release.yml",
          "line": 6,
          "note": "contents: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "High",
          "description": "overly broad permissions",
          "file": ".github/workflows/release.yml",
          "line": 7,
          "note": "packages: write is overly broad at the workflow level",
          "rule": "excessive-permissions",
          "severity": "High",
          "url": "https://docs.zizmor.sh/audits/#excessive-permissions"
        },
        {
          "confidence": "Medium",
          "description": "code injection via template expansion",
          "file": ".github/workflows/version_comparison.yml",
          "line": 90,
          "note": "this step",
          "rule": "template-injection",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "Medium",
          "description": "code injection via template expansion",
          "file": ".github/workflows/version_comparison.yml",
          "line": 90,
          "note": "this step",
          "rule": "template-injection",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "Medium",
          "description": "code injection via template expansion",
          "file": ".github/workflows/version_comparison.yml",
          "line": 93,
          "note": "this step",
          "rule": "template-injection",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "Medium",
          "description": "code injection via template expansion",
          "file": ".github/workflows/version_comparison.yml",
          "line": 105,
          "note": "this step",
          "rule": "template-injection",
          "severity": "Medium",
          "url": "https://docs.zizmor.sh/audits/#template-injection"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/canary.yml",
          "line": 55,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        },
        {
          "confidence": "High",
          "description": "use GitHub's dedicated self-repository syntax",
          "file": ".github/workflows/release.yml",
          "line": 59,
          "note": "this step",
          "rule": "self-repository",
          "severity": "Low",
          "url": "https://docs.zizmor.sh/audits/#self-repository"
        }
      ]
    }
  },
  "updated": "2026-11-02"
}